I have found this is very useful if you want to check or wandering a file format.
| Hex Signature |
|
ASCII Signature |
| File Extension |
|
File Description |
| TGA |
|
Truevision Targa Graphic file
Trailer:
54 52 55 45 56 49 53 49 TRUEVISI
4F 4E 2D 58 46 49 4C 45 ON-XFILE
2E 00 .. |
| 00 |
|
. |
| PIC |
|
IBM Storyboard bitmap file |
| 00 |
|
. |
| PIF |
|
Windows Program Information File |
[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 |
|
[11 byte offset]
……..
……..
…….. |
| PDB |
|
Palmpilot Database/Document File |
| 00 00 00 xx 66 74 79 70 |
|
….ftyp |
| 3GG, 3G2 |
|
3rd Generation Partnership Project 3GPP (xx=0×14)
and 3GPP2 (xx=0×20) multimedia files |
| 00 00 01 00 |
|
…. |
| ICO |
|
Windows icon file |
| 00 00 01 Bx |
|
…. |
| MPG |
|
MPEG video file |
| 00 00 02 00 |
|
…… |
| CUR |
|
Windows cursor file |
| 00 00 1A 00 10 04 |
|
…… |
| WKS |
|
Lotus MS Works document |
| 00 00 49 49 58 50 52 or |
|
..IIXPR |
| 00 00 4D 4D 58 50 52 |
|
..MMXPR |
| QXD |
|
Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0×52 (“R”) is
the language indicator; 0×33 (“3″) seems to indicate English
and 0×61 (“a”) reportedly indicates Korean. |
[7 byte offset]
00 00 FF FF FF FF |
|
[7 byte offset]
..ÿÿÿÿ |
| HLP |
|
Windows Help file |
00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
61 73 65 |
|
….MSIS
AM Datab
ase |
| MNY |
|
Microsoft Money file |
00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
20 44 42 |
|
….Stan
dard Jet
DB |
| MDB |
|
Microsoft Access file |
00 01 00 08 00 01 00 01
01 |
|
……..
. |
| IMG |
|
Ventura Publisher/GEM VDI Image Format Bitmap file |
00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00 |
|
…a….
…Ò…. |
| DB |
|
Netscape Navigator (v4) database file |
| 00 11 AF |
|
..¯ |
| FLI |
|
FLIC Animation file |
| 00 1E 84 90 00 00 00 00 |
|
…….. |
| SNM |
|
Netscape Commuicator (v4) mail folder |
[512 byte offset]
00 6E 1E F0 |
|
[512 byte offset]
.n.ð |
| PPT |
|
PowerPoint presentation subheader |
| 01 00 00 00 |
|
…. |
| EMF |
|
Extended (Enhanced) Windows Metafile Format, printer spool file
(0×18-17 & 0xC4-36 is Win2K/NT; 0×5C0-1 is WinXP) |
| 01 00 00 00 01 |
|
….. |
| PIC |
|
Unknown type picture file |
| 01 10 |
|
.. |
| TR1 |
|
Novell LANalyzer capture file |
| 01 DA 01 01 00 03 |
|
.Ú…. |
| RGB |
|
Silicon Graphics RGB Bitmap |
| 01 FF 02 04 03 02 |
|
.ÿ…. |
| DRW |
|
Micrografx vector graphic file |
| 03 |
|
. |
| DB3 |
|
dBASE III file |
| 03 00 00 00 |
|
…. |
| QPH |
|
Quicken QPH file |
| 04 |
|
. |
| DB4 |
|
dBASE IV data file |
| 07 |
|
. |
| DRW |
|
A common signature and file extension for many drawing
programs. |
| 08 |
|
. |
| DB |
|
dBASE IV or dBFast configuration file |
[512 byte offset]
09 08 10 00 00 06 05 00 |
|
[512 byte offset]
…….. |
| XLS |
|
Excel spreadsheet subheader |
| 0A xx 01 01 |
|
…. |
| PCX |
|
ZSOFT Paintbrush file
(where xx = 0×02, 0×03, or 0×05) |
| 0C ED |
|
.í |
| MP |
|
Monochrome Picture TIFF bitmap file (unconfirmed) |
[512 byte offset]
0F 00 E8 03 |
|
[512 byte offset]
..è. |
| PPT |
|
PowerPoint presentation subheader |
| 11 00 00 00 53 43 43 41 |
|
….SCCA |
| PF |
|
Windows prefetch file |
| 1A 0x |
|
.. |
| ARC |
|
LH archive file, old version
(where x = 0×8 or 0×9) |
| 1A 0B |
|
.. |
| PAK |
|
Compressed archive file
(often associated with Quake Engine games) |
| 1A 35 01 00 |
|
.5.. |
| ETH |
|
GN Nettest WinPharoah capture file |
| 1D 7D |
|
.} |
| WS |
|
WordStar Version 5.0/6.0 document |
| 1F 8B 08 |
|
… |
| GZ |
|
GZIP archive file |
| 1F 9D 90 |
|
… |
| TAR.Z |
|
Compressed tape archive file |
21 3C 61 72 63 68 3E 0A
2F 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 |
|
!<arch>.
/
|
| LIB |
|
Microsoft Program Library Common Object File Format (COFF) |
| 21 42 44 4E |
|
!BDN |
| PST |
|
Microsoft Outlook Personal Folder file |
23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F |
|
# Micros
oft Deve
loper St
udio |
| DSP |
|
Microsoft Developer Studio project file |
24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45 |
|
$FL2@(#)
SPSS DA
TA FILE |
| SAV |
|
SPSS Data file |
25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30 |
|
%!PS-Ado
be-3.0 E
PSF-3.0 |
| EPS |
|
Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30) |
| 25 50 44 46 |
|
%PDF |
| PDF |
|
Adobe Portable Document Format file
Trailers:
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.) |
[2 byte offset]
2D 6C 68 |
|
[2 byte offset]
-lh |
| LZH |
|
Compressed archive file |
| 2E 52 4D 46 |
|
.RMF |
| RM |
|
Real media file |
| 30 00 00 00 4C 66 4C 65 |
|
0…LfLe |
| EVT |
|
Windows Event Viewer file |
30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C |
|
0&²u.fÏ.
¦Ù.ª.bÎl |
| ASF |
|
Microsoft Media Audio/Video File (Advanced Streaming Format) |
| 31 BE or |
|
1¾ |
| 32 BE |
|
2¾ |
| WRI |
|
Microsoft Write file |
| 34 CD B2 A1 |
|
4Ͳ¡ |
| n/a |
|
Extended tcpdump (libpcap) capture file (Linux/Unix) |
| 37 7A BC AF 27 1C |
|
7z¼¯’. |
| 7Z |
|
7-Zip compressed file |
| 38 42 50 53 |
|
8BPS |
| PSD |
|
Photoshop image file |
| 3C 21 64 6F 63 74 79 70 |
|
<!doctyp |
| DCI |
|
AOL HTML mail file |
| 3F 5F 03 |
|
?_. |
| HLP |
|
Windows Help file |
| 41 43 53 44 |
|
ACSD |
| n/a |
|
Miscellaneous AOL parameter and information files |
| 41 4D 59 4F |
|
AMYO |
| SYW |
|
Harvard Graphics symbol graphic |
41 4F 4C 20 46 65 65 64
62 61 67 |
|
AOL Feed
bag |
| BAG |
|
AOL and AIM buddy list file |
| 41 4F 4C 44 42 |
|
AOLDB |
| ABY, IDX |
|
AOL database files: address book (ABY) and user configuration
data (MAIN.IDX) |
| 41 4F 4C 49 44 58 |
|
AOLIDX |
| IND |
|
AOL client preferences/settings file (MAIN.IND) |
| 41 4F 4C 49 4E 44 45 58 |
|
AOLINDEX |
| ABI |
|
AOL address book index file |
| 41 4F 4C 56 4D 31 30 30 |
|
AOLVM100 |
| n/a |
|
AOL personal file cabinet (PFC) file |
| 42 4D |
|
BM |
| BMP, DIB |
|
Windows bitmap image |
| 42 5A |
|
BZ |
| BZ2, TAR.BZ2, TBZ2, TB2 |
|
bzip2 compressed archive |
| 43 42 46 49 4C 45 |
|
CBFILE |
| CBD |
|
WordPerfect dictionary file (unconfirmed) |
| 43 44 30 30 31 |
|
CD001 |
| ISO |
|
ISO-9660 CD Disc Image
(This signature usually occurs at byte 8001, 8801, or 9001.) |
| 43 57 53 |
|
CWS |
| SWF |
|
Shockwave Flash file (v5+) |
| 43 6C 69 65 6E 74 20 55 |
|
Client U |
| DAT |
|
IE History DAT file |
45 52 46 53 53 41 56 45
44 41 54 41 46 49 4C 45 |
|
ERFSSAVE
DATAFILE |
| DAT |
|
Kroll EasyRecovery Saved Recovery State file |
| 45 56 46 |
|
EVF |
| Enn (where nn are numbers) |
|
EnCase evidence file |
46 41 58 43 4F 56 45 52
2D 56 45 52 |
|
FAXCOVER
-VER |
| CPE |
|
Microsoft Fax Cover Sheet |
| 46 45 44 46 |
|
FEDF |
| SBV |
|
(Unknown file type) |
| 46 4C 56 |
|
FLV |
| SWF |
|
Flash video file |
| 46 57 53 |
|
FWS |
| SWF |
|
Shockwave Flash file |
| 46 72 6F 6D 20 20 20 or |
|
FHom |
| 46 72 6F 6D 20 3F 3F 3F or |
|
FHom ??? |
| 46 72 6F 6D 3A 20 |
|
FHom: |
| EML |
|
A commmon file extension for e-mail files. Signatures shown here
are for Netscape, Eudora, and a generic signature, respectively.
EML is also used by Outlook Express and QuickMail. |
| 47 46 31 50 41 54 43 48 |
|
GF1PATCH |
| PAT |
|
Advanced Gravis Ultrasound patch File |
| 47 49 46 38 37 61 or |
|
GIF87a |
| 47 49 46 38 39 61 |
|
GIF89a |
| GIF |
|
Graphics interchange format file
Trailer: 00 3B (.;) |
| 47 50 41 54 |
|
GPAT |
| PAT |
|
GIMP (GNU Image Manipulation Program) pattern file |
| 47 58 32 |
|
GX2 |
| GX2 |
|
Show Partner graphics file (not confirmed) |
| 48 48 47 42 31 |
|
HHGB1 |
| SH3 |
|
Harvard Graphics presentation file |
| 49 20 49 |
|
I I |
| TIF |
|
Tag image file format (TIFF) file |
| 49 44 33 |
|
ID3 |
| MP3 |
|
MPEG/MP3 audio file |
| 49 49 2A |
|
II* |
| TIF |
|
Tag image file format (TIFF) file (little
endian, i.e., LSB first in the byte; Intel) |
| 49 54 53 46 |
|
ITSF |
| CHM |
|
Microsoft HTML Help Compiled Help File |
| 4A 47 03 0E 00 00 00 or |
|
JG….. |
| 4A 47 04 0E 00 00 00 |
|
JG….. |
| ART |
|
AOL ART file |
| 4C 00 00 00 01 14 02 00 |
|
L……. |
| LNK |
|
Windows shortcut file |
| 4C 01 |
|
L. |
| OBJ |
|
Relocatable object code |
| 4C 4E 02 00 |
|
LN.. |
| HLP |
|
Windows Help file |
| 4D 4D 00 2A |
|
MM.* |
| TIF |
|
Tag image file format (TIFF) file (big
endian, i.e., LSB last in the byte; Motorola) |
| 4D 4D 4D 44 00 00 |
|
MMMD.. |
| MMF |
|
Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
for multimedia files that can be played on hand-held devices. |
| 4D 53 43 46 |
|
MSCF |
| CAB |
|
Microsoft cabinet file |
| PPZ |
|
Powerpoint Packaged Presentation |
| SNP |
|
Microsoft Access Snapshot Viewer file |
| 4D 54 68 64 |
|
MThd |
| MID, MIDI |
|
Musical Instrument Digital Interface (MIDI) sound file |
| 4D 56 |
|
MV |
| DSN |
|
CD Stomper Pro label file |
| 4D 5A |
|
MZ |
| COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS |
|
Windows/DOS executable file |
| AX |
|
Library cache file |
| CPL |
|
Control panel application |
| FON |
|
Font file |
| FLT |
|
Graphic filter file |
| OCX |
|
ActiveX or OLE Custom Control |
| OLB |
|
OLE object library |
| SCR |
|
Screen saver |
| VBX |
|
VisualBASIC application |
| VXD, 386 |
|
Windows virtual device drivers |
4D 69 63 72 6F 73 6F 66
74 20 56 69 73 75 61 6C
20 53 74 75 64 69 6F 20
53 6F 6C 75 74 69 6F 6E
20 46 69 6C 65 |
|
Microsof
t Visual
Studio
Solution
File |
| SLN |
|
Visual Studio .NET Solution file |
[84 byte offset]
4D 69 63 72 6F 73 6F 66
74 20 57 69 6E 64 6F 77
73 20 4D 65 64 69 61 20
50 6C 61 79 65 72 20 2D
2D 20 |
|
[84 byte offset]
Microsof
t Window
s Media
Player -
- |
| WPL |
|
Windows Media Player playlist |
4F 50 4C 44 61 74 61 62
61 73 65 46 69 6C 65 |
|
OPLDatab
aseFile |
| DBF |
|
Psion Series 3 Database file |
| 4F 7B |
|
O{ |
| DW4 |
|
Visio/DisplayWrite 4 text file (unconfirmed) |
| 50 00 00 00 20 00 00 00 |
|
P… … |
| IDX |
|
Quicken QuickFinder Information File |
| 50 35 0A |
|
P5. |
| PGM |
|
Portable Graymap Graphic |
| 50 41 43 4B |
|
PACK |
| PAK |
|
Quake archive file |
| 50 49 43 54 00 08 |
|
PICT.. |
| IMG |
|
ADEX Corp. ChromaGraph Graphics Card Bitmap Graphic file |
| 50 4B 03 04 |
|
PK.. |
| ZIP |
|
PKZIP archive file (Ref. 1 | Ref. 2)
Trailer: filename 50 4B 17 characters 00 00 00
Trailer: (filename PK 17 characters …) |
| JAR |
|
Java archive; compressed file package for classes and data |
| SXC, SXD, SXI, SXW |
|
OpenOffice spreadsheet, drawing, presentation, and text files |
| XPI |
|
Mozilla Browser Archive |
| XPT |
|
eXact Packager Models |
[30 byte offset]
50 4B 4C 49 54 45 |
|
[30 byte offset]
PKLITE |
| ZIP |
|
PKLITE compressed ZIP archive (see also PKZIP) |
[526 byte offset]
50 4B 53 70 58 |
|
[526 byte offset]
PKSFX |
| ZIP |
|
PKSFX self-extracting executable compressed file (see also PKZIP) |
| 50 4D 43 43 |
|
PMCC |
| GRP |
|
Windows Program Manager group file |
[92 byte offset]
51 45 4C 20 |
|
[92 byte offset]
QEL |
| QEL |
|
Quicken data file |
| 51 46 49 FB |
|
QFI. |
| IMG |
|
QEMU Qcow Disk Image |
| 51 57 20 56 65 72 2E 20 |
|
QW Ver. |
| ABD, QSD |
|
Quicken data file |
| 52 45 47 45 44 49 54 34 |
|
REGEDIT4 |
| REG, SUD |
|
Windows NT Registry and Registry Undo files |
52 49 46 46 xx xx xx xx
41 43 4F 4E |
|
RIFF….
ACON |
| ANI |
|
Resource Interchange File Format — Animated Cursor file |
52 49 46 46 xx xx xx xx
41 56 49 20 4C 49 53 54 |
|
RIFF….
AVI LIST |
| AVI |
|
Resource Interchange File Format — Windows Audio
Video Interleave file |
52 49 46 46 xx xx xx xx
43 44 44 41 66 6D 74 20 |
|
RIFF….
CDDAfmt |
| CDA |
|
Resource Interchange File Format — Compact Disc
Digital Audio (CD-DA) file |
52 49 46 46 xx xx xx xx
51 4C 43 4D 66 6D 74 20 |
|
RIFF….
QLCMfmt |
| QCP |
|
Resource Interchange File Format — Qualcomm
PureVoice |
52 49 46 46 xx xx xx xx
52 4D 49 44 64 61 74 61 |
|
RIFF….
RMIDdata |
| RMI |
|
Resource Interchange File Format — Windows Musical
Instrument Digital Interface file |
52 49 46 46 xx xx xx xx
57 41 56 45 66 6D 74 20 |
|
RIFF….
WAVEfmt |
| WAV |
|
Resource Interchange File Format — Audio for
Windows file |
| 52 54 53 53 |
|
RTSS |
| CAP |
|
Windows NT Netmon capture file |
| 52 61 72 21 1A 07 00 |
|
Rar!… |
| RAR |
|
WinRAR compressed archive file |
| 53 43 4D 49 |
|
SCMI |
| IMG |
|
Img Software Set Bitmap |
| 53 48 4F 57 |
|
SHOW |
| SHW |
|
Harvard Graphics DOS Ver. 2/x Presentation file |
53 49 45 54 52 4F 4E 49
43 53 20 58 52 44 20 53
43 41 4E |
|
SIETRONI
CS XRD S
CAN |
| CPI |
|
Sietronics CPI XRD document |
| 53 4D 41 52 54 44 52 57 |
|
SMARTDRW |
| SDR |
|
SmartDraw Drawing file |
| 53 6D 62 6C |
|
Smbl |
| SYM |
|
(Unconfirmed file type. Likely type is Harvard Graphics
Version 2.x graphic symbol or Windows SDK graphic symbol) |
| 56 43 50 43 48 30 |
|
VCPCH0 |
| PCH |
|
Visual C PreCompiled header file |
| 57 53 32 30 30 30 |
|
WS2000 |
| WS2 |
|
WordStar for Windows Ver. 2 document |
[29,152 byte offset]
57 69 6E 5A 69 70 |
|
[29,152 byte offset]
WinZip |
| ZIP |
|
WinZip compressed archive |
| 58 43 50 00 |
|
XCP. |
| CAP |
|
Cinco NetXRay, Network General Sniffer, and
Network Associates Sniffer capture file |
58 50 43 4F 4D 0A 54 79
70 65 4C 69 62 |
|
XPCOM.Ty
peLib |
| XPT |
|
XPCOM type libraries for the XPIDL compiler |
| 5B 4D 53 56 43 |
|
[MSVC |
| VCW |
|
Microsoft Visual C++ Workbench Information File |
| 5B 50 68 6F 6E 65 5D |
|
[Phone] |
| DUN |
|
Dial-up networking file (unconfirmed) |
| 5B 56 45 52 5D 0D 0A 09 or |
|
[VER]… |
| 5B 76 65 72 5D 0D 0A 09 or |
|
[ver]… |
| SAM |
|
AMU Pro document |
[2 byte offset]
5B 56 65 72 73 69 6F 6E |
|
[2 byte offset]
[Version |
| CIF |
|
(Unknown file type) |
5B 57 69 6E 64 6F 77 73
20 4C 61 74 69 6E 20 |
|
[Windows
Latin |
| CPX |
|
Microsoft Code Page Translation file |
| 5F 43 41 53 45 5F |
|
_CASE_ |
| CAS, CBK |
|
EnCase case file (and backup) |
| 60 EA |
|
`ê |
| ARJ |
|
Compressed archive file |
| 64 00 00 00 |
|
d... |
| P10 |
|
Intel PROset/Wireless Profile |
| 64 73 77 66 69 6C 65 |
|
dswfile |
| DSW |
|
Microsoft Visual Studio workspace file |
[4 byte offset]
6D 6F 6F 76 |
|
[4 byte offset]
moov |
| MOV |
|
QuickTime movie file |
.MOV files have a complicated file signature.The string “moov” is the most common but I have also seen:
0×66-72-65-65 free
0×6D-64-61-74 mdat
0×77-69-64-65 wide
And the following have been reported to me:
0×70-6E-6F-74 pnot
0×73-6B-69-70 skip
Furthermore, if you look at byte position xxxxxxxx+4 (hex), you will find one (or more!) of these strings repeated;
the string “free” seems to be the most common. (Thanks to D. Wright for getting me started on this!)
|
| 72 65 67 66 |
|
regf |
| n/a |
|
Windows registry hive file |
73 72 63 64 6F 63 69 64
3A |
|
srcdocid
: |
| CAL |
|
CALS raster bitmap file |
| 73 7A 65 7A |
|
szez |
| PDB |
|
PowerBASIC Debugger Symbols file |
| 7B 0D 0A 6F 20 |
|
{..o |
| LGC, LGD |
|
Windows application log |
| 7B 5C 72 74 66 31 |
|
{\rtf1 |
| RTF |
|
Rich text format word processing file
Trailer: 5C 70 61 72 20 7D 7D (\par }}) |
| 7F 45 4C 46 |
|
.ELF |
| n/a |
|
Executable and Linking Format executable file (Linux/Unix) |
| 80 |
|
. |
| OBJ |
|
Relocatable object code |
| 81 CD AB |
|
.Í« |
| WPF |
|
WordPerfect text file |
| 89 50 4E 47 0D 0A 1A 0A |
|
.PNG…. |
| PNG |
|
Portable Network Graphics file |
| 95 00 or |
|
.. |
| 95 01 |
|
.. |
| SKR |
|
PGP secret keyring file |
| 99 01 |
|
.. |
| PKR |
|
PGP public keyring file |
[512 byte offset]
A0 46 1D F0 |
|
[512 byte offset]
F.ð |
| PPT |
|
PowerPoint presentation subheader |
| A1 B2 C3 D4 |
|
¡²ÃÔ |
| n/a |
|
tcpdump (libpcap) capture file (Linux/Unix) |
| A1 B2 CD 34 |
|
¡²Í4 |
| n/a |
|
Extended tcpdump (libpcap) capture file (Linux/Unix) |
| A9 0D 00 00 00 00 00 00 |
|
©……. |
| DAT |
|
Access Data FTK evidence file |
| AC 9E BD 8F |
|
¬.½. |
| QDF |
|
Quicken data file |
| B5 A2 B0 B3 B3 B0 A5 B5 |
|
µ¢°³³°¥µ |
| CAL |
|
(Unknown file type…) |
| C5 D0 D3 C6 |
|
ÅÐÓÆ |
| EPS |
|
Adobe encapsulated PostScript file |
| CD 20 AA AA 02 00 00 00 |
|
Í ªª…. |
| n/a |
|
Norton Anti-Virus quarantined virus file |
| CF 11 E0 A1 B1 1A E1 00 |
|
Ï.ࡱ.á. |
| DOC |
|
Perfect Office document
[Note similarity to MS Office header, below] |
| CF AD 12 FE |
|
Ï.þ |
| DBX |
|
Outlook Express e-mail folder |
| D0 CF 11 E0 A1 B1 1A E1 |
|
ÐÏ.ࡱ.á |
| DOC, DOT, PPS, PPT, XLA, XLS, WIZ |
|
Microsoft Office applications (Word, Powerpoint, Excel, Wizard)
[See also Word, Powerpoint, and Excel "subheaders" at byte offset 512] |
| DB |
|
MSWorks database file |
| MSC |
|
Microsoft Common Console Document |
| MSI |
|
Microsoft Installer package |
| MTW |
|
Minitab data file |
| OPT |
|
Developer Studio File Workspace Options file |
| SOU |
|
Visual Studio Solution User Options file |
| SPO |
|
SPSS output file |
| VSD |
|
Visio file |
| WPS |
|
MSWorks text document |
| D2 0A 00 00 |
|
Ò… |
| FTR |
|
GN Nettest WinPharoah filter file |
| D4 2A |
|
Ô* |
| ARL, AUT |
|
AOL history (ARL) and typed URL (AUT) files |
| D4 C3 B2 A1 |
|
Ôò¡ |
| n/a |
|
WinDump (winpcap) capture file (Windows) |
| D7 CD C6 9A |
|
×ÍÆ. |
| WMF |
|
Windows graphics metafile |
| DC FE |
|
Üþ |
| EFX |
|
eFax file format |
| E3 82 85 96 |
|
ã… |
| PWL |
|
Windows password file |
| E8 or |
|
è |
| E9 or |
|
é |
| EB |
|
ë |
| COM, SYS |
|
Windows executable file |
| EB 3C 90 2A |
|
ë<.* |
| IMG |
|
GEM Raster file |
[512 byte offset]
EC A5 C1 00 |
|
[512 byte offset]
ì¥Á. |
| DOC |
|
Word document subheader |
| ED AB EE DB |
|
í”îÛ |
| RPM |
|
RedHat Package Manager file |
[512 byte offset]
FD FF FF FF 04 |
|
[512 byte offset]
ýÿÿÿ. |
| SUO |
|
Visual Studio Solution User Options subheader |
[512 byte offset]
FD FF FF FF xx 02 |
|
[512 byte offset]
ýÿÿÿ.. |
| XLS |
|
Excel spreadsheet subheader
(where xx = 0×10, 0×22, 0×23, 0×28, or 0×29) |
[512 byte offset]
FD FF FF FF 20 00 00 00
03 |
|
[512 byte offset]
ýÿÿÿ …
. |
| OPT |
|
Developer Studio File Workspace Options subheader |
| FF |
|
ÿ |
| SYS |
|
Windows executable (SYS) file |
FF 00 02 00 04 04 05 54
02 00 |
|
ÿ……T
.. |
| WKS |
|
Works for Windows spreadsheet file |
| FF 46 4F 4E 54 |
|
ÿFONT |
| CPI |
|
Windows international code page |
| FF 4B 45 59 42 20 20 20 |
|
ÿKEYB |
| SYS |
|
Keyboard driver file |
| FF 57 50 43 |
|
ÿWPC |
| WPD, WPG, WP5 |
|
WordPerfect text and graphics file |
FF D8 FF E0 xx xx 4A 46
49 46 00 |
|
ÿØÿà..JF
IF. |
| JFIF, JPE, JPEG, JPG |
|
JPEG/JFIF graphics file
Trailer: FF D9 (..) |
FF D8 FF E1 xx xx 45 78
69 66 00 |
|
ÿØÿá..Ex
if. |
| JPG |
|
Digital camera JPG using Exchangeable Image File Format (EXIF)
Trailer: FF D9 (..)
See “Using Extended File Information (EXIF) File Headers in Digital
Evidence Analysis” (P. Alvarez, IJDE, 2(3), Winter 2004) |
| FF Ex |
|
ÿ. |
| FF Fx |
|
ÿ. |
| MPEG, MPG, MP3 |
|
MPEG audio file frame synch pattern |
| FF FE |
|
ÿþ |
| REG |
|
Windows Registry file |
FF FE 23 00 6C 00 69 00
6E 00 65 00 20 00 31 00 |
|
ÿþ#.l.i.
n.e. .1. |
| MOF |
|
Windows MSinfo file |
| FF FF FF FF |
|
ÿÿÿÿ |
| SYS |
|
DOS system driver |
是已被破解的微软MPEG4编码/译码器(视窗媒体视频V3)的名称。这些codec是微软为他的视窗媒体架构所开发的，它最初可以用来译码AVI以及 ASF格式，但是所有非测试版本都被加上了AVI锁，从而使得不能使用他们来进行AVI编码且目前只有极少数工具支持ASF格式。DivX的创作者们所作 的是去除AVI锁从而是它们可以重新用于AVI编码，将名字更换为DivX的原因是为了避免与众多codec混淆，这样在同一台电脑上同时使用破解过以及 未破解过的 视窗媒体编码器(Windows Media Encoder) 就成为可能了。最新版的DivX还包括了一个已被破解了的视窗音频媒体编码/译码器，称作DivX音频。由于它的破解目前来说不甚完美，所以用它来进行高 码率编码会受到限制。这个codec也被称作DivX3。
